-
Notifications
You must be signed in to change notification settings - Fork 92
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
skmsg: Fix wrong last sg check in sk_msg_recvmsg() #3401
Conversation
Master branch: 40b0965 |
Master branch: 40b0965 |
266d5e4
to
a70fb5e
Compare
Master branch: 64893e8 |
a70fb5e
to
b2afc10
Compare
Master branch: 64893e8 |
b2afc10
to
9f415af
Compare
Master branch: 64893e8 |
9f415af
to
89f8e98
Compare
Master branch: 58250ae |
89f8e98
to
0f34d56
Compare
Master branch: 5eff8c1 |
0f34d56
to
0549901
Compare
Master branch: a6df067 |
0549901
to
f140f3d
Compare
Master branch: 639de43 |
f140f3d
to
4f1f7a6
Compare
Master branch: dc81f8d |
4f1f7a6
to
8016c20
Compare
Master branch: 3b317ab |
8016c20
to
885a6fe
Compare
Master branch: d0b80a9 |
885a6fe
to
27d4dbb
Compare
Master branch: 14250fa |
27d4dbb
to
a90d1aa
Compare
Master branch: 14250fa |
a90d1aa
to
f59313c
Compare
6ec485a
to
43cd555
Compare
Master branch: 54c9397 |
43cd555
to
fd9dcd8
Compare
Master branch: 4961d07 |
fd9dcd8
to
c1981a2
Compare
Master branch: cea5588 |
c1981a2
to
622ceb7
Compare
Master branch: 8308bf2 |
622ceb7
to
f48a0c3
Compare
Master branch: 8308bf2 |
f48a0c3
to
c58e8ea
Compare
Master branch: 1f23577 |
c58e8ea
to
ed8aecd
Compare
Master branch: 1f23577 |
ed8aecd
to
95c38a6
Compare
Master branch: 807662c |
95c38a6
to
070d231
Compare
Master branch: 807662c |
070d231
to
de7d48f
Compare
Master branch: 738a2f2 |
de7d48f
to
7b9526d
Compare
Master branch: 738a2f2 |
Fix one kernel NULL pointer dereference as below: [ 224.462334] Call Trace: [ 224.462394] __tcp_bpf_recvmsg+0xd3/0x380 [ 224.462441] ? sock_has_perm+0x78/0xa0 [ 224.462463] tcp_bpf_recvmsg+0x12e/0x220 [ 224.462494] inet_recvmsg+0x5b/0xd0 [ 224.462534] __sys_recvfrom+0xc8/0x130 [ 224.462574] ? syscall_trace_enter+0x1df/0x2e0 [ 224.462606] ? __do_page_fault+0x2de/0x500 [ 224.462635] __x64_sys_recvfrom+0x24/0x30 [ 224.462660] do_syscall_64+0x5d/0x1d0 [ 224.462709] entry_SYSCALL_64_after_hwframe+0x65/0xca In commit 9974d37 ("skmsg: Fix invalid last sg check in sk_msg_recvmsg()"), we change last sg check to sg_is_last(), but in sockmap redirection case (without stream_parser/stream_verdict/ skb_verdict), we did not mark the end of the scatterlist. Check the sk_msg_alloc, sk_msg_page_add, and bpf_msg_push_data functions, they all do not mark the end of sg. They are expected to use sg.end for end judgment. So the judgment of '(i != msg_rx->sg.end)' is added back here. Fixes: 9974d37 ("skmsg: Fix invalid last sg check in sk_msg_recvmsg()") Signed-off-by: Liu Jian <liujian56@huawei.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Acked-by: Jakub Sitnicki <jakub@cloudflare.com>
7b9526d
to
adfc3f5
Compare
At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=666250 irrelevant now. Closing PR. |
Pull request for series with
subject: skmsg: Fix wrong last sg check in sk_msg_recvmsg()
version: 1
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=663736